Supervisory system with failure discrimination



'ug. 24, 1965 w. G. RowELL 5 Sheets-Sheet 1 Filed Dec. 3.

f N VEN TOJ` W/u/AM 6. Pon/ELL BY A7 f ORNE YJ suPERvIsoRY SYSTEM wITHFAILURE DISCRIMINATION Aug. 24, 1965 w. G. RowELL 5 Sheets-Sheet 2 FiledDeo. 3,

SUPERVISORY SYSTEM WITH FAILURE DISCRIMINATION Aug. 24, 1965 w. s.Rowr-:LL

Filed Deo. 5 Sheets-Sheet 3 ww www Mami m ATTORNEYS United States PatentO 3,202,976 SUPERVISORY SYSTEM WITH FAILURE DISCRIMINATION William G.Rowell, Quincy, Mass., assignor to Scully Signal Company, Melrose,Mass., a corporation of Massachusetts Filed Dec. 3, 1959, Ser. No.857,080 21 Claims. (Cl. 340-213) The present invention relates tomethods of and systems for automatically discriminating beween a failurewithin a signal transmission system of any type, and a failure of thesignal itself that is to be applied to the system.

In process or other monitoring systems, and, in fact,

Vin supervisory systems of all kinds, as Well as detection systems,control systems, alarm systems, and the like,

all generically referred to herein as signal transmission systems, anacute problem relating to false alarms, nusiance and false shutdownscontinues to plague the industry. While such unnecessary shut-downs,caused by the failure of the control or monitor, as distinguished fromfailure of the process or condition being controlled Aor monitored,desirably result in a 'safe failure, the

ultimate end result can, in some instances, be costly or otherwiseuneconomic, since the shut-down will interrupt a properly operatingprocess or condition. Proper utilization of the present inventionrequires Vthat the system with which it is associated must, in itself,

2,807,010 and 2,807,011, issued to William G. Rowell.

Present-day commercial monitoring systems, with the exception of thoseemploying the techniques disclosed in the Letters Patentenumeratedabove, cannot provide *a completely reliable signal when failure ofcertain components in the system takes place.- As an example, cony sidera simple on and off type of monitoring control that functions to providean on signal when a principal signal representative of the conditionthat it is monitoring, is present at its input. The control must alsofuncltion to give an off signal when the principal inputV signal 'islost. Inherent in such controls, however, is

the possibility of failure ofcertain components in the system which willthen cause either a false signal, or no signal at all to be produced.Thus, the control can fail in two ways-safe or unsafe; the safe failureoccurring when Ythe control goes to the oli position, and the unsafefailure occurring when the control remains in the on position, When anunsafe failure occurs, therefore, no indication whatever is given thatthe control is completely inoperative and unable to detect the conditionit isintended to monitor.

Accordingly, it is a requisite for full utilization of the presentinvention, that `it be employed only in connection withV fail-safesystems that have the perfomance characteristics of the type abovereferred 4to and disclosed in vthe Letters Patent before enumerated.`The control or 'monitoring system mustproduce a failure signalvregardless ofV any component failure that may occur and irrespective ofwhether the failure be of a safe or unsafe variety.

A-n important object of the present invention is to provide a novelmethod of ,and system for automatically checking'the operation of asignal transmission system of any type, such as monitoring systems andthejlike,

ice

upon receipt of a failure signal, to determine and thereby indicatewhether it is the system which fai-led or whether it is the principalsignal itself, representative of the condition to be monitored or thelike, that failed to appear at the input of the system.

A further object is to` provide such a technique and system for failurediscriminationv that is particularly useful in electrical, electronic,hydraulic, mechanical or electro-mechanical transmission systems,control systems, supervising systems and the like.

An additional object is to provide .a system for accomplishing the aboveobjects that'shall be inexpensive though completely reliable, relativelysimple and readily adaptable to existing fail-safe systems, especiallyof the types disclosed in the above-mentioned Letters Patent.

Other and further objects will be explained hereinafter and will be moreparticularly pointed out in the appended claims.

The invention will now be described in connection With the accompanyingdrawing,

FIG. 1 of which is a block diagram illustrating the principle ofoperation of the invention applied one form a fail-safe transmissionsystem;

FIG. 2 is ablock diagram illustrating the invention embodied in a secondform of a fail-safe transmission system; v

FIG. 3 is a block diagram of still athirdform of a fail-safetransmission system, FIGURE 3A illustrating a variation; Y Y

FIG. 4 is a'detailed schematic diagram of a preferred form of theinvention, applied, for disclosure purposes,

Zto the signal transmission Vsystem shown inthe block vdiagram of FIG.1, variations being illustrated in FIG.

4A, 4B, and 4C. -It is to be understood, however, that the applicationof the invention to the system disclosed in FIG. 1 is but one of thehost of forms of systems to which Vthe invention is applicable.- l

Referring, now, to FIG. l, thereis disclosed a principal signal source 1that provides a principal signal along the path 2. As but a signalillustration, the

source 1 could be a flame, as later described in connection with theembodiment of FIG. 4, or it could be a "signal generator or other eventor condition producer Patent. Vor receiver 3 the .output V4 of whichfeeds a transmission to generically, as indicator apparatus.

to bedetected or sensed, as described in the said letters Thesignal isdirected upon a sensor or detector system 16,' such as an amplifiersystemor any other system having an input 5. An output switching system7,

`later described, is provided, feeding a novel checkingtransmittedthrough the signal transmission system V6 to actuate the outputswitching system 7. The output switching system 7 thereupon responds,placing a predetermined form'of modification or Vmodulation on thesignal fed along rthe path 21 to the input 5, which modication is thenretransmittedthrough the system 6 to the output 7 again. The outputswitching system 7 will then respond to this modified signal `to.restore the output signal from the sensor 3 to its original form and toAreapply Athis principal signal to the input 5 of the signal transmissionsystem 6. 'This repetitive'action thereby provides a periodic checkingsignal, which cannot exist in the absence of the principal signal, andto which the before-mentioned checking vsignal recovery anddiscriminating system 8 may respond. Inasmuch as this modulation.

The discriminating portion of the system 8, in accord- ,ance with thepresent invention, upon receiving a signal from the checking 'signalrecovery part of the system 8,

.functions to providean indication of normal operationV to theindicating or control system l9. In the event of Yfailure by thechecking signal recovery system to recover the checking signal, thediscriminating system will apply 'a simulated sensor output signal,along path 22, to the output 4 of the sensor 3, or directly to the input5 of "the signal transmission system 6, if desired. If the signaltransmission system 6 has failed,this simulated signal will not, aslater explained, activate the systemv 6. "If the signaltransmissionsystemr has not failed, however, it `will react normally tothis simulated signal.v `The resultant signals from either of theseconditions will be Vtranslated by the discriminating system 8 which willthen act toY provide a proper indication inthe indicating or controlsystem 9, of which type of'failure occurred'.Y This an additionalexample, the monitored principal signal is visible radiation, alightbulb could be utilized at 12; and so on. The operation of FIG. 3 isotherwise similar to that of FIG. 2 except that the feed-back outputsignal of the discriminating system, along paths 22 and 22 (or,alternatively, as shown in FIGURE 3A, paths 22 and 22"), is in the formof a simulated input principal signal 'to the Vsignal modifier 10 (or,alternatively, to the sensor V35), as contrasted with the systems ofFIGS. 1 and 2 wherein the output signal from the discriminator 8 is inthe form of a Vsimulatedsensor output signal.

Referring, now, to the preferred system of FIG. 4, a

' flame-monitoring circuit is disclosed, for purposes of iling techniqueof this invention has been applied. A fiame may, for example,` thencause a standbyrcontrol, indica-H system 6 and sensor 3comprisingatwo-position switch S, and an independent external controlV source 11.VIn

, `this embodiment, a fail-safe Vsystemvris provided wherein theprincipal Vsignal is supplied with a` checking modification ahead of thesensor 3whereas in the system of FIG. '1, the checking modication'wasapplied to the principal output signal ofthe sensor 3, as beforeexplained. When `the switch 'S is in position a, the signal modifier 10is controlled by the signal output switching system.7. When the'switchisvin position b, however, the modifier 10 is controlled by theindependent source 11. The principal "signal modifier 10 may be of thetypes described in the said Letters Patent or of any other appropriatetype 4such as, for example, a disk, not shown,having` opaque sectionsand which, Awhen caused to rotate, either bythe output-switchingsystem'7 or thev controlsource 11, will,mod ulate or modifythe principalsignal transmitted along the Ypath2, thus to apply the circuit-checkingmodification or The4 operation ofthe discriminating and indicating orcontrol system of FIG. 2 is lessentially the probe sensor 3 is shownconnected to the input 5 of the Vsignal transmission amplifier system 6,the circuit of which passes through the normally closed switch contactmembers I and I', controlled by the armature AR of 'a relay RYl disposedin the ampliferoutput 7. YA photoemissive cell sensor 3', shown inFIGURE 4A, could also Abe used to sense the flame condition or event, ascould a signal recovering system 8, comprising relay RY2and integratingcapacitor C5, is shown responsively connected to the contact member B ofthe vamplifier outputswitching relay RYI. A discriminating system isalso included at In theV embodiment of FIG." 3, on the other hand, a

'still' further alternativeY modification is yillustrated in order todemonstrate'the Wideversatility` of the invention'. A

new element 12 hasbeen added in FIG. 3 to the systems ,shown in FIGS.'v1 and 2;V namely, means for simulating. the principal signalvZ itselfemanating from the principalY signal source 1.,. As disclosed in, forexample, the above- VThis isneces's'ary if maxi# mum fail-safeprotection isto be assured. 'The sensor 3 for example, the monitoredprincipal signal is infrared energy' or heat, the simulated signal couldbe Vobtained fromthe electrical heatingl element at 12. If, on the otherA,mentioned Letters Patent No. 2,798,214, the'` checking sigi `nal"mustbe applied ahead of the first component in the fsystem that can failunsafe.

8 comprising the sequence or memory relays RYS and RYt with their"associated circuits to which intelligence signals are transmitted fromrelay'RYZ. Associated with ,the sequence relays RY3 and RY4 is a resetswitch S Ithrough which the sequence relays RY3 and RY4 electricallylock up and'remain energized, once they are initially energized. In theevent automatic program sequencing is used in place of the/illustratedmanual operation, the, manually Voperated reset switch S could bereplaced with well-known automatic reset switching means,schelma'tically shown at S in FIGURE 4C, as part of the programmingmechanism. The indicating system 9 shownlconsists of threesign'al lampsLP1, LP2 and LPS, producing visual manifestations, to denote anormalmonitored condition, control failure and principalV input signalfailure,respectively, thereby to discriminate the kind of failure. Thissignaling system is under control of the vchecking signal recoveryrelayRYZ and the sequence relays 'RYSand RY4 of the discriminatingsystem 8.

`Igt is important to point out at this point that it is `to beunderstood that indication control relays, Asuch as RY3 .and RYf,vvcould equally as well be used either in 'conjunction with thevisualsignaling indicating system 9,

or Without it, to perform indicating control functions,

In the event that monitored principal sign-al, it may be desirable toactuate .an alarm and automatically switch on, in well-known manner, .astand-byl monitoring control 6 as shownfin .FIGURE 4B, rather than stopthe process being monii:fored.;V Such a function would automatically beperfor-medby use of the control relays mentioned above. A lrelay DPW,.as shown connected to the LPZ circuit, for

instance, could be adapted lreadily to perform this funcs fhand,. themonitored'principal signal is ultraviolet radia-I ltion, asianotherillustration, a small electric arcvat`12 ,would produce the simulatedVprincipal signal. If, as still tion- As avfurther step in Ithe directionof safety, such standby monitoring control could lbe renderedself-check-l ing during standby periods through use of .the techniques fdisclosedin the ab,ove-entimeratcdk Letters Patent,`

NORMAL OPERATING lCONDITION-WIG. 4

It now remains to describe, in detail, the operation o-f 'the system ofFIG. 4. With a burner llame event established, a small DC. current ofnegative polarity is established at the output terminal 4 of the llameprobe sensor 3. It is well known in the art, as explained in the saidLetters Patent, lthat a llame will have rectifying ch-aracteristics ifan alternating-current (A.C.) potential is `aiprplied to it. The A.C.potential suppflied to the flame is traced in FIG. 4 from .groundterminal G through the secondary winding S2 of transformer T, byconductor 30 through capacitor O1 to the llame probe 3, through thellame to the burner B producing the llame, and back to ground at G. Thesecon-dary winding S2, and also a heater winding S1 for the heaters HWof the amplifier tubes 'Ill and T2 and a further winding S3, areener-gized from a primary winding PRl of the transformer T that may beconnected to the mains, labelled A.C. Line. The resulting negativepotential at the output 4 of the flame probe 3 (or photocell 3', orwhatever suitable sensor may be used), is applied at the input circuit 5to the ,input or control grid 31 of electron tube T1 by conductor 20 andthrough resistor R1, when switch member I contacts the contact .I ofrelay RYd. This prevents .tube rIll from normallyconducting. Tube T2Ywill, however, conduct when T1 is cut oi, due to the voltage Ydividernet "work arrangement comprising resistors R3 and.R4, conuected acrossthe further winding S3. The grid 31' of tube T2 is connected `to theanode or plate 32 of tube 'D1 by conductor 36, and thence .to thejunction of R3 and R4, .and the cathode 33' of the tube T2 is connected'to Ythe left-hand terminal of RB by conductor 35. The cathf ode 33 oftube Til is grounded at G", Iand the anode or plate .32' o f tube T12connects through `capacitor C3 to .the right-hand terminal of R4.Conversely, when tube 'Ill is conducting, it applies a negative bias tothe grid 311' of .tube T2 and prevents T2 from conducting.

With T2 conducting, however, during .the cut-off of T11,

p relay RYl is energized since it is v.in lseries Withthe plate circuitsupply voltage to tube T2. lPrevious t-o the energizingof RYL capacitorhas been charged through a circuit traced Lfrom ground G,l throughthevoltage terminals of the secondary WindingsSZ and S3A of transformerT, through a direct-current-converting rectifier REGL through contact Cand switch II of relay RYI1 `to a further storage 4capacitor O4, andthen, from capacitor` C4 through current-limiting resistor R5 to ground,Y \With RY11 energized, however, switch II moves into contact withcontact B. This action 4then-transfers lthe stored, voltage in capacitorC4to the inte-grating capacitor C5 which is in parallel with the windingof RYLand causes load relay RYZ to become energized. It can be seen.that when relay RYtl becomes energized, its armature AR also opensswitch I from engagement with contact I', which opens the inputcircuit.5 to the plained, which, in turn, causes relay RYI to becomedeenergized; yRelay RY1., in releasing', causes its armature AR to moveswitch l1 back 4into engagement with contact C, which again causes C4 tobecome charged through yIthe circuit previously described. Relay RY2,however,

does not release during the relatively brief-periods that C4 is beingre-charged, because the stored energy in C5A will `hold RY@ energizedfor Ja' predeterminedl period longer than those periods of re-charge.Relay RYL in releasing, `also causes switch I to engage contact I whichwill restore the principal .signal to the amplifier input 5 and againcause relay RYl to operate. Thus, a repetitive self-checking actionoccurs only so long as the principal signal lappears at the input 5 andthe monitoring Vsystem 6 remains operative. This cycling action of thechecking relay RY1 provides a checking signal which is monitored,sensed, detected or recovere-d by lthe integrating capacitor C5 andrelay RYZ, which remain energized only approximately so lon-g as thecheck- .ing signal is present; i;e. for a period of time substantiallyequal to (preferably just greater than) the period or periods ofvrepetition of the checking signal. This selfcheck-in-g, fail-safetechnique is more fully described, for example, in :the said LettersIPatent No. 2,798,213.

When relay RY2 became energized, as before described, the action ofswitch II engaging contact C causes sequence relayv RY4 also to bec-omeenergized. This .energizing circuit may be traced from ground G""through switch III and contact C of relay RYZ, by Way of the input leadconductor 37 to the sequence relays, to switch IV, engaging contact C"of relay RY3, by conductor .38 through the winding of relay RY4, throughthe rectifier RECZ and its protective resistor Re, and, by conductor 39,lto the AJC. line. Relay RY4 in thus operating, closes its switch V intoengagement with contact .B" which, in turn, closes .a circuit toenergize indicator LPI and provide a normal operating indica-tion of themonitored condition. This energizing circuit is traced from the H sideof the AC line, by conductor 3S, through contact B" and swi-tch V ofRY4, by conductor 40, through LEI, and thence by conductor 41 throughswitch IV' and contact B" of relay RYS to ground `G". When switch -IVengages contact C of relay IRY3,Ait places :a Iground .shunt `across thewinding of RY3 to prevent its operation at this time. It can b e seenthat ground from switch V and contact C' ofA relay RY4 appears at oneside of the Winding of RY3 and ground Vfrom switch III .and contact C ofrelay RYZ appears at the other side of the winding of RY3, and operationat this time is lthus prevented. Thus, during normal operati'on, thenormal indication LP-l is given, which indicates that the monitoredcondition is normal. Relay-s RY@ and RY4 are maintained energized andthe self-checking relay Rill is continuously pulsing.

MONITORING SYSTEM FAILURE I CONDITION-FIG. 4

Withthe monitoring system in normal operation, as described above, letit be assumed that a component fails therein. A failure of any nature,safe or unsafe, will Valways result in causing the self-checking relayRY1 to cease pulsing and, depending upon the type of failure, RYI willremain in either of its two positions-energized or de-energized. As thechecking signal no longer exists, Vrelay RY2 will release. In releasing,relay RY2 removes the'shunt ground on the lower endl` of the winding ofRY3 that was previously placed on the input wire 37 to the sequencerelays. This ground, as pointed out above, under normal operation, wasfrom switchIlI and Contact C'` of relay RY2, over the input lead 37ofthe 'sequence relays ,to switch IV and contact Cof 'relay vRY3, and tothe lower end of the winding of RY3. Re-

lay RY3 will operate, as its coil is now in Aseries with the energizedcoil of relay RY4; In operating relayRYS vcloses further switch l intoengagement with grounded contact F,`which`energizes a circuit path 22,including a `4 in order that the wiring betweenthe sensor output and theamplifier input may be checked. As previously pointed out, the principalllame signal is a small D.C. current of negative polarity, RectifierREC3 provides the rectification to supply the negative simulated D.C.

' signal and resistor R7 limits the current to the amount normallysupplied by the flame-probe circuit. This simulation circuit is `tracedfrom ground through contact F and switch IV" of Yrelay RYB, throughresistor R7, recti- .input of the monitoring system 6.

case, however, the monitoring system did not fail but,` linstead, themonitored principal signal was lost. i The fier REC3, cirouit'path 22capacitor C1` and then the secondary winding S2 of transformer T togroundrG. In this manner,-the simulated principal signal isl applied tothe input 5 of the monitoring system 6. Due to the fact, however, thatthe .monitoring lsystem has failed,

there will be no response to this failure discriminating testY signal.`An indicating signal will now be presented 'to show that the monitoringsystemitself has failed. This 'circuit is traced from ground G" throughswitch III and 'contact B' of relay RYZ, by conductor 43 throughindicatorLPZ, and Yby switch V and contact B. of relay monitoring systemhas failed, thus, indicators LP1 and LP2 will both be energized, theenergizing circuit for LPI having been previously discussed. IndicatorVLP1 indicates that the monitored condition or process lwas normal at thetime the monitoring system failed, and indicator LPZ indicates that`'the monitoring system itself has failed. i Y A control circuitassociated with the indicating system cuit will not be energized whenthe monitoredy principal signal itself fails. Thus, under the abovetworconditions of normal operation and monitoring system failure, the

fuel' valve would remain energized and not cause the "process that isbeing controlled by the flame unnecessarily to be interfered with. Itmight-also be desirable i at this Atime for the suggested control-signalmanifestation indicative of monitoring Ysystem failure to function toactuate a standby monitoring systemsuch as 6', before mentioned, andth-us prevent continued unmonitored operation of the process orcondition. The above monitoring.` system failure results in'rtheenergizingfof relays RY3, Y

MONITORED CONDITION FILURE--FIG. 4

lLoss of the principal monitored: signal at the ,input` of themonitoringsystem results in the,Y checking Vrelay 'RY4 tothe H side ofthe A.C. Line. When the V Indcation RYl becoming dex-energized. "This,in turn, causes `the Y checking signal produced by RYl to cease. vThechecking signal recovery relay RYZ will also become cle-energized :uponloss of the checking signal. `Exactlyin the manner dscribed undervfmonitoring system failure condition above, sequence relay RY3 willbecome energized and cause a simulated principal signal to be applied tothe simulated principal signal now applied to the input, there- .'fore,will cause the checking relay RY1 to become rerelay RY3 and ,throughcontacts C' and switch Ill'of relay RYZ to ground G. Thus, the LPSindicating or In this present ating condition, vRYZwill reoperate. ARYZin operatfY ing, will close a circuit to energize Vthe indicator LPS,which circuit may be .traced from` the VH side of the f AQC. line, byconductor 39, through` contact B" and vswitch of relay RY4, by conductor40 through LP3, by

conductor 44 and through contact E and switch IV off the'energization ofonly the LPS indicator.V This indicating signal is-of primeimportancebecause the. principal functionof the monitoring system itself isl todetect the 4loss ofthe signal or condition monitored. Again, as pointed.'out above' underl monitoring system failure condition, suitable controlrelays, such as LPZ, may

leasily beV employed in connection with the indicating sys- ,tem of theinvention to Vperform any control, alarm,

regulating or other signal-manifestation function` as deemed necessaryfor any given application of the invention, the term indicatinggenerically describing all such operations. Theabove-monitored'condition failure re- Vsults vin relays RYZ, RY: and RY4being energized, alarm or indicating, circuit LP3 energized and RYIpulsingas longV as the simulated principal signal appears atl the inputof the signal transmission system.

:The following table summarizes the relay operation:

CONDITIONS oF sEQUENoIuYi-r MEMORY RELAYS ars,

Normal Relays i K A Y Operation obntrm Failure Dia-energizedDe-energized-- Energized 'Energlzed Enprgivpd Y Energized-- Energized.Energized. Energized.

:mentioned signal. l

Pulsing fromY simulated jflame signal.

Pulsingfrom ame Y signal.

Quieseent'.

As is explained in the said lLetters Patent, other types of switchingorrelay means'than the particular electromechanical switches oroscillating relays R Y1, RYZ, RY3, RY4 may be employed, as it wellrknown, and further modifications willy ,also occur to 'those skilledinthe art, all such'being 4c'onsideredfto vfallwithin the spiritandV.scope of lthe inventionas defined in the appended'- claims.

What is claimed is;

In `combination with a system in which asignal4 is `to kbeVvtransmitte'dbetween the input and `output:ofthe "system, meansforapplyingto'the inputarepetitively 'modified signal, meansconnectedzto the output'for-re. sponding to the recovery therein of therepetitively modiiied signal and forgproduc'ing a predetermined out-put'sig- -nal condition when'said -modified signal vis absent from said'`output upon a failure inf the systempor a lo'ss of the signal,rneansresponsiveto -t'he Vpredetermined foutput if signal conditionforinjecting into/the input azsimulation of the said signal, means operableinthe event-of'failure of said responding means to respond to thesimulated signal for indicatingja'failure in the' system; and meansoperable -in the event of response ofthe v'responding means lto the4simulatedsignal for indicating loss of the i'rst- 2. The .combination@i claim rand in which ,the signal .60, applying meansgco'mprises means'responsive tothe `output .responsive'tosa-idrespondingfrneans. v i.

^ 3." The vcombination of claim I1 and in which said signal e applyingmeans comprises a' signal modier external to of said syste-m* and saidvinjecting means comprises means said inputy andisaid injectingrmeanscomprises means responsiveto -said responding means.` Y L A i 4 Thecombination of clafimfS, further comprising 'means for controlling saidexternal signal'modifier from alarm circuit willbe energized to showthat the monitored 7 5.' The `combination .of claimA 3, furthercomprising .means for controlling said'external signal modifier fromanindependent.source external tosaid system. I' j 6; The combination oflclaimyl andrinwhi'ch said signalv i' applying means comprises a signalmodifier external to said input, and said injecting means comprises agenerator sontrollerlby Saidresponding mean# Y,

7. The combination of claim 6 and in which said generator is connectedto the signal modier.

8. The combination as claimed in claim 6 and in which said generator isconnected to the system input.

9. The combination as claimed in claim 1, further comprising a standbymonitoring system, and control circuit means responsive to `a failure inthe system for operating said standby monitoring system.

10. In combina-tion with a system in which a signal is to be transmittedbetween the input and output of the system representative 'of anevent-to-be-detected repetitively modified atfa rate or 'ratescorresponding to a period or periods of repetition less than apredetermined time interval, van `event-detecting device connected withsaid input -for producing the said repetitively modied signal .in thepresence of the event-.to-be-detected, mean-s connected to the outputfor responding to .the repetitively m-odified signal, means operable inthe event of failure of-said responding means to respond to saidrepetitively modified signal for a time substantially equal to the saidpredetermined time interval for thereupon Iindicating such failure by apredetermined output signal condition, and means responsive to the saidpredetermined output signal condition for distinguishing between suchfailure resulting from -loss of the event-to-be-detected and suchfailure resulting from a defect lin said system.

-11. In combination with a system in which a signal is to be transmittedbetween the input and output of the system representative of anevent-to-be-detected repetitively modified at a rate or ratescorresponding to a period or periods of repetition less than apredetermined time interval, an event-.detecting device connected withsaid input for produc-ing the said repetitively modified signal in thepresence of the event-to-be-detected, means connected to the output forresponding to the repetitively modified signal, means operable in theevent of failure of said responding means to respond to saidrepetitively modified signal for a time substantially equal to the saidpredetermined time interval for thereupon indicating suc-h failure by apredetermined output signal condition, means responsive to the saidpredetermined output signal condition for injecting into the input asimulated signal corresponding to ,the event-to-be-detected, meansoperable inthe event of failure thereupon of said responding means torespond to the simulated signal in the output for indicating a defect inthe system, and means operable in the event of response of saidresponding means to the sim-uylated signal in the output for indicatingloss of the eventto-be-detected.

12. A fail-safe system for preventing false effective energization of anelectrical load through integrity failure of any of the components ofthe system having, in cornbination, voltage terminals energizable withalternatingcurrent potential, rectifier means for converting saidpotential to direct-current potential during energization from saidvoltage terminals, capacitor means connected with said rectifier meansfor storing the converted potential, switching means having multiplepositions, means for operating said switching means recurrently betweenits position-s at a predetermined frequency in response to a principalsignal, said switching means being arranged in one of its positions toswitch said voltage terminals to said rectifier means and capacitormeans in order to permit said capacitor means to store the convertedpotential, said switching means being further arranged in another of itspositions to disconnect the rectifier means from the capacitor means, aload that, with respect to the halfperiod of the said predeterminedfrequency, is slowly deenergizable and is adapted to be responsive todirectcurrent potential and arranged to be effectively energized fr-omsaid stored converted potential during the recurrent periods that therectifier means is disconnected from the capacitor means, meanscontrolled by the load for feeding a signal simulating the principalsignal to operate the switching means in event of cessation of therecurrent having a predetermined rate or ratesof repetition istransmitted from the input to the. output of the system, said outputhaving switchingmeans responsive to the checking signal for repetitivelyoccupying alternate positions at said repetition rate or rates, meansfor supplying alternating` current potential, means for convertingalternating-current potential into direct-current potential,potential-storing means, an electric circuit operative when theswitching means occupies one of its positions to connect together thesupplying means, the converting means, and the storing means, in orderto store direct-current potential in the storing means, adirect-current-operated load adapted to respond after the elapse of aperiod greater than the period or periods of the said repetition rate orrates, a further electric circuit operative when the switching meansoccupies the alternate position to connect the potentialstoring means tothe load, discriminating means controlled by the load for feeding asignal simulating the principal ysignal to said input upon cessation ofthe repetitive switching of said switching means and the resultingresponse of said load, and means operative upon continued response ofsaid load for indicating failure of a component of the system andoperative upon renewal of the repetitive switching of the switchingmeans for indicating failure of the principal signal itself.

15. The combination as claimed in claim 14 and in which the said loadcomprises further switching means, and means controlled by said furtherswitching means for indicating normal operation of said system inresponse to said repetitive switching, said discriminating meanscomprising additional switching means for controllingsaid means forindicating failure of a component and failure of the principal signal. k

16. The combination as claimed in claim 15, further comprising a standbymonitoring system controlled by said additional switching means.

17. The combination of claim 15 and in which said additional switchingmeans in one position operates means for generating said simulatedsignal and feeding the same to said system input.

18. The combination as claimed in claim 17 and in which said principalsignal is a signal representative of a flame and the like, and saidgenerating means comprises a circuit for producing a signal simulatingthe Vprincipal signal produced by the flame and the like.

19. The combination as claimed in claim 14 and in which said indicatingmeans comprises a plurality of indicating devices, one producing anindication of normal operation, a second producing an indication offailure of the system, and a third producing an indication of failure ofthe principal signal itself. 1

20. In combination with a signal transmission system for transmittingbetween its input and output a principal signal, means connected to theinput of said system for sensing said principal signal and applying itto said input, checking means for repetitively modifying the principalsignal applied to said input from said sensing means, recovering meansconnected to the output of'said system for recovering the modificationof said signal and upon failure to recover said modification forthereupon providing a first control signal, discriminating meansresponsive to said first control signal and for thereupon applying asimulated principal signal to said input, means operable for providing asecond'control signal, indicating means responsive t-o said secondcontrol signal for indicating that loss of the principal. signal at theinput of said system has occurred, and means operable upon failure ofsaid recovery means to respond to said simulated Vsignal for thereuponindicating that failure in ythe said signal transmis- Sion system hasoccurred. Y 21. The combination VasI claimed in claim120, furthecomprising indicating means for indicating normal operaltion of saidsystem in response to recovery of said modication by saidrecovering'means.

Y References Cited by the Examiner "UNITED STATES PATENTS Norton 340-228Deziel et al 158-28 XR Loudon et al 340-213 RX Weisz et al 340-213Rowell Y f 340-213 Rowell 340-213 Deziel.

vFlory et al. 340-248 NEIL C. REAnrmary Examiner.

"BENNETT G. MILLER, Examiner.

1. IN COMBINATION WITH A SYSTEM IN WHICH A SIGAL IS TO BE TRANSMITTEDBETWEEN THE INPUT AND OUTPUT OF THE SYSTEM, MEANS FOR APPLYING TO THEINPUT A REPETITIVELY MODIFIED SIGNAL, MEANS CONNECTED TO THE OUTPUT FORRESPONDING TO THE RECOVERY THEREIN OF THE REPETITIVELY MODIFIED SIGNALAND FOR PRODUCING A PREDETERMINED OUTPUT SIGNAL CONDITION WHEN SAIDMODIFIED SIGNAL IS ABSENT FROM SAID OUTPUT UPON A FAILURE IN THE SYSTEMOR A LOSS OF TRHE SIGNAL, MEANS RESPONSIVE TO THE PREDETERMINED OUTPUTSIGNAL CONDITION FOR INJECTING INTO THE INPUT A SIMULATION OF THE SAIDSIGNAL, MEANS OPERABLE IN THE EVENT OF FAILURE OF SAID RESPONDING MEANSTO RESPOND TO THE SIMULATED SIGNAL FOR INDICATING A FAILURE IN THESYSTEM, AND MEANS OPERABLE IN THE EVENT OF RESPONSE OF THE RESPONDINGMEANS TO THE SIMULATED SIGNAL FOR INDICATING LOSS OF THE FIRSTMENTIONEDSIGNAL.